forum.opennet.ru - "ipsec PIX C805. Прошу помощи." (7)

форумы

помощь

поиск

регистрация

майллист

ВХОД

слежка

"ipsec PIX C805. Прошу помощи."

Форумы Маршрутизаторы CISCO и др. оборудование. (Public)
Вариант для распечатки		Пред. тема \| След. тема
Изначальное сообщение		[Проследить за развитием треда]

"ipsec PIX C805. Прошу помощи."
Сообщение от svsleaves (ok) on 20-Июн-05, 13:06 (MSK)
Заранее благодарен за любой совет. Не поднимается ipsec между PIX и C805 Следовал примеру http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094498.shtml 10.13.0.0/24-...-10.10.11.2pix82.140.75.254-...-195.190.123.218-C805-195.190.115.233/10.13.1.1-...-10.13.1.0/24 Debug на pix ISAKMP (0): beginning Quick Mode exchange, M-ID of 170287282:a2660b2IPSEC(key_engine): got a queue event... IPSEC(spi_response): getting spi 0x1514481(22103169) for SA from 195.190.123.218 to 82.140.75.254 for prot 3 crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500 ISAKMP (0): processing NOTIFY payload 14 protocol 3 spi 22103169, message ID = 279330906 ISAKMP (0): deleting spi 2168738049 message ID = 170287282 Конфиги: PIX: : Saved : Written by enable_15 at 17:25:11.987 UTC Mon Apr 19 1993 PIX Version 6.3(1) interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security50 enable password NTyzxVSprcCKilM0 encrypted passwd Qt1rdtL1kEqOKn8. encrypted hostname pix domain-name transas.com fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol ils 389 fixup protocol pptp 1723 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 names access-list 111 permit tcp any host 82.140.75.2 eq smtp access-list 111 permit tcp any host 82.140.75.2 eq 465 access-list 111 permit tcp any host 82.140.75.2 eq imap4 access-list 111 permit tcp any host 82.140.75.2 eq 993 access-list 111 permit tcp any host 82.140.75.2 eq domain access-list 111 permit udp any host 82.140.75.2 eq domain access-list 111 permit tcp any host 82.140.75.2 eq ftp access-list 111 permit tcp any host 82.140.75.2 eq www access-list 111 permit tcp any host 82.140.75.2 eq 578 access-list 111 permit tcp any host 82.140.75.11 eq smtp access-list 111 permit tcp any host 82.140.75.14 eq smtp access-list 111 permit tcp any host 82.140.75.14 eq 465 access-list 111 permit tcp any host 82.140.75.14 eq www access-list 111 permit tcp any host 82.140.75.15 eq www access-list 111 permit tcp any host 82.140.75.18 eq www access-list 111 permit tcp any host 82.140.75.19 eq www access-list 111 permit tcp any host 82.140.75.21 eq www access-list 111 permit tcp any host 82.140.75.21 eq https access-list 111 permit tcp any host 82.140.75.24 eq www access-list 111 permit tcp any host 82.140.75.26 eq www access-list 111 permit tcp any host 82.140.75.27 eq www access-list 111 permit tcp any host 82.140.75.28 eq www access-list 111 permit tcp any host 82.140.75.32 eq www access-list 111 permit tcp any host 82.140.75.33 eq www access-list 111 permit tcp any host 82.140.75.34 eq www access-list 111 permit tcp any host 82.140.75.35 eq www access-list 111 permit tcp any host 82.140.75.36 eq www access-list 111 permit tcp any host 82.140.75.37 eq www access-list 111 permit tcp any host 82.140.75.40 eq www access-list 111 permit tcp any host 82.140.75.41 eq www access-list 111 permit tcp any host 82.140.75.42 eq www access-list 111 permit tcp any host 82.140.75.42 eq smtp access-list 111 permit tcp any host 82.140.75.43 eq www access-list 111 permit tcp any host 82.140.75.44 eq www access-list 111 permit tcp any host 82.140.75.44 eq https access-list 111 permit tcp any host 82.140.75.45 eq www access-list 111 permit tcp any host 82.140.75.46 eq www access-list 111 permit tcp any host 82.140.75.47 eq www access-list 111 permit tcp any host 82.140.75.50 eq www access-list 111 permit tcp any host 82.140.75.51 eq www access-list 111 permit tcp any host 82.140.75.52 eq www access-list 111 permit tcp any host 82.140.75.53 eq www access-list 111 permit tcp any host 82.140.75.55 eq www access-list 111 permit tcp any host 82.140.75.56 eq www access-list 111 permit tcp any host 82.140.75.57 eq www access-list 111 permit tcp any host 82.140.75.58 eq www access-list 111 permit tcp any host 82.140.75.102 eq www access-list 111 permit tcp any host 82.140.75.115 eq www access-list 111 permit tcp any host 82.140.75.125 eq www access-list 111 permit tcp any host 82.140.75.132 eq www access-list 111 permit tcp any host 82.140.75.115 eq https access-list 111 permit tcp any host 82.140.75.125 eq https access-list 111 permit tcp any host 82.140.75.132 eq https access-list 111 permit tcp any host 82.140.75.252 eq pptp access-list 111 permit gre any host 82.140.75.252 access-list 111 permit tcp any host 82.140.75.2 eq ldaps access-list 111 permit esp any 82.140.75.216 255.255.255.248 access-list 111 permit ah any 82.140.75.216 255.255.255.248 access-list 111 permit udp any 82.140.75.216 255.255.255.248 eq isakmp access-list 111 permit icmp any any access-list 111 permit tcp any any eq domain access-list 111 permit udp any any eq domain access-list 111 permit tcp any host 82.140.75.103 eq www access-list 111 permit tcp any host 82.140.75.103 eq https access-list 111 permit tcp any host 82.140.75.130 eq pptp access-list 111 permit gre any host 82.140.75.130 access-list 111 permit tcp any host 82.140.75.134 eq www access-list 111 permit tcp any host 82.140.75.135 eq www access-list 111 permit tcp host 80.70.228.221 host 82.140.75.111 gt 1024 access-list 111 permit tcp host 80.70.228.221 host 82.140.75.111 eq telnet access-list 111 permit tcp any host 82.140.75.88 eq https access-list 111 permit udp any any eq isakmp access-list 111 permit tcp any host 82.140.75.130 eq ftp access-list 111 permit tcp any host 213.64.141.77 eq pptp access-list 111 permit gre any host 213.64.141.77 access-list 111 permit ip any host 213.64.141.77 access-list 111 permit ip any host 213.64.141.1 access-list 111 permit ip 195.190.123.0 255.255.255.0 any access-list 111 permit ip 195.190.115.0 255.255.255.0 any access-list 101 permit ip 10.10.0.0 255.255.0.0 10.0.0.0 255.255.0.0 access-list 112 permit icmp any any access-list 112 permit udp any any eq domain access-list 112 permit tcp any any eq domain access-list 112 permit tcp any any access-list 112 permit tcp any host 10.10.10.2 eq smtp access-list 112 permit udp host 10.10.0.113 host 82.140.75.1 eq snmp access-list 112 permit udp host 10.10.10.113 host 82.140.75.1 eq snmp access-list 113 permit ip any any access-list nonat permit ip 10.13.0.0 255.255.255.0 10.13.1.0 255.255.255.0 access-list ipsec01 permit ip 10.13.0.0 255.255.255.0 10.13.1.0 255.255.255.0 pager lines 25 logging on logging timestamp logging standby logging console alerts logging monitor alerts logging buffered alerts logging trap alerts logging history alerts logging queue 0 mtu outside 1500 mtu inside 1500 mtu dmz 1500 ip address outside 82.140.75.254 255.255.255.0 ip address inside 10.10.11.2 255.255.255.0 ip address dmz 10.10.10.1 255.255.255.0 ip audit name IDS_in info action alarm drop reset ip audit name IDS_at attack action alarm drop reset ip audit info action alarm ip audit attack action alarm no failover failover timeout 0:00:00 failover poll 15 no failover ip address outside no failover ip address inside no failover ip address dmz pdm location 10.0.3.240 255.255.255.255 inside pdm location 82.140.75.234 255.255.255.255 dmz pdm history enable arp timeout 14400 global (outside) 3 82.140.75.61-82.140.75.68 netmask 255.255.255.0 global (outside) 3 82.140.75.69 netmask 255.255.255.0 global (outside) 2 82.140.75.70 netmask 255.255.255.0 global (outside) 4 82.140.75.80 netmask 255.255.255.0 global (inside) 2 10.10.11.3 netmask 255.255.255.0 global (dmz) 1 10.10.10.60-10.10.10.68 netmask 255.255.255.0 global (dmz) 1 10.10.10.69 netmask 255.255.255.0 global (dmz) 2 10.10.10.70 netmask 255.255.255.0 nat (inside) 0 access-list nonat nat (inside) 2 10.10.0.204 255.255.255.255 0 0 nat (inside) 2 10.10.3.0 255.255.255.0 0 0 nat (inside) 4 10.10.80.0 255.255.255.0 0 0 nat (inside) 1 10.13.0.0 255.255.255.0 0 0 nat (inside) 2 10.71.0.0 255.255.255.0 0 0 nat (inside) 2 10.72.0.0 255.255.255.0 0 0 nat (inside) 2 10.203.0.0 255.255.0.0 0 0 nat (inside) 2 10.204.0.0 255.255.0.0 0 0 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 nat (dmz) 0 access-list 101 nat (dmz) 3 10.10.10.0 255.255.255.0 0 0 static (dmz,outside) 82.140.75.11 10.10.10.11 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.14 10.10.10.14 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.15 10.10.10.15 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.18 10.10.10.18 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.19 10.10.10.19 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.21 10.10.10.21 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.24 10.10.10.24 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.26 10.10.10.26 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.28 10.10.10.28 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.32 10.10.10.32 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.34 10.10.10.34 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.35 10.10.10.35 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.40 10.10.10.40 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.41 10.10.10.41 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.42 10.10.10.42 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.43 10.10.10.43 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.45 10.10.10.45 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.46 10.10.10.46 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.47 10.10.10.47 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.52 10.10.10.52 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.53 10.10.10.53 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.55 10.10.10.55 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.56 10.10.10.56 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.57 10.10.10.57 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.58 10.10.10.58 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.115 10.10.10.115 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.125 10.10.10.125 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.132 10.10.10.132 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.252 10.10.10.252 netmask 255.255.255.255 0 0 static (inside,dmz) 10.10.10.2 10.10.0.2 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.103 10.10.10.103 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.130 10.10.10.130 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.134 10.10.10.134 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.135 10.10.10.135 netmask 255.255.255.255 0 0 static (dmz,outside) 82.140.75.111 10.10.10.111 netmask 255.255.255.255 0 0 static (inside,outside) 82.140.75.27 10.10.10.15 netmask 255.255.255.255 0 0 static (inside,outside) 82.140.75.28 10.10.10.28 netmask 255.255.255.255 0 0 access-group 111 in interface outside access-group 113 in interface inside access-group 112 in interface dmz conduit permit tcp host 82.140.75.130 eq ftp any route outside 0.0.0.0 0.0.0.0 82.140.75.1 1 route inside 10.10.0.0 255.255.0.0 10.10.11.1 1 route inside 10.13.0.0 255.255.255.0 10.10.11.1 1 route inside 10.71.0.0 255.255.255.0 10.10.11.1 1 route inside 10.72.0.0 255.255.255.0 10.10.11.1 1 route inside 10.202.0.0 255.255.0.0 10.10.11.1 1 route inside 10.203.0.0 255.255.0.0 10.10.11.1 1 route inside 10.204.0.0 255.255.0.0 10.10.11.1 1 timeout xlate 1:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http 10.0.3.240 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set IPSeccard ah-md5-hmac esp-3des esp-md5-hmac crypto ipsec transform-set E01 esp-des esp-md5-hmac crypto ipsec security-association lifetime seconds 3600 crypto map IPSec 10 ipsec-isakmp crypto map IPSec 10 match address 101 crypto map IPSec 10 set peer 195.144.252.226 crypto map IPSec 10 set transform-set IPSeccard crypto map IPSec 10 set security-association lifetime seconds 28800 kilobytes 4608000 crypto map M01 21 ipsec-isakmp crypto map M01 21 match address ipsec01 crypto map M01 21 set peer 195.190.123.218 crypto map M01 21 set transform-set E01 crypto map M01 21 set security-association lifetime seconds 28800 kilobytes 4608000 crypto map M01 interface outside isakmp enable outside isakmp key Quai4ahw address 195.190.123.218 netmask 255.255.255.255 isakmp identity address isakmp policy 21 authentication pre-share isakmp policy 21 encryption des isakmp policy 21 hash md5 isakmp policy 21 group 2 isakmp policy 21 lifetime 86400 telnet 10.10.255.100 255.255.255.255 inside telnet 10.10.255.100 255.255.255.255 dmz telnet timeout 5 ssh 10.10.0.0 255.255.255.0 inside ssh 10.10.3.0 255.255.255.0 inside ssh 10.10.255.0 255.255.255.0 inside ssh timeout 30 console timeout 0 terminal width 80 Cryptochecksum:ad44b9e4da909f6990070a5831569047 : end =========================================================== c805: Current configuration : 1389 bytes ! version 12.3 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname Linkor ! boot-start-marker boot system flash c805-k9osy6-mw.123-12.bin boot-end-marker ! enable secret 5 $1$nePH$Cj75JCvSKE.qDp1z6GxJX1 ! no aaa new-model ip subnet-zero ! ! ! ! ! crypto isakmp policy 11 hash md5 authentication pre-share group 2 crypto isakmp key ********* address 82.140.75.254 ! ! crypto ipsec transform-set sharks esp-des esp-md5-hmac ! crypto map nolan 11 ipsec-isakmp set peer 82.140.75.254 set transform-set sharks match address 120 reverse-route remote-peer 195.190.123.217 ! ! ! interface Ethernet0 ip address 10.13.1.1 255.255.255.0 secondary ip address 195.190.115.233 255.255.255.252 ! interface Serial0 ip address 195.190.123.218 255.255.255.252 ! ip classless ip route 0.0.0.0 0.0.0.0 Serial0 no ip http server no ip http secure-server ! logging trap debugging access-list 1 permit 10.13.0.0 0.0.0.255 access-list 1 permit 192.168.0.0 0.0.255.255 access-list 1 permit 10.13.1.0 0.0.0.255 access-list 1 permit 82.140.75.0 0.0.0.255 access-list 120 permit ip 10.13.1.0 0.0.0.255 10.13.0.0 0.0.0.255 ! ! line con 0 transport preferred all transport output all stopbits 1 line vty 0 4 password 7 04730A1527704F471A1A0A login transport preferred all transport input all transport output all ! end ======================================= На c805 #show crypto engine connections active ID Interface IP-Address State Algorithm Encrypt Decrypt 22 Serial0 195.190.123.218 set HMAC_MD5+DES_56_CB 0 0 sh crypto map Crypto Map "nolan" 11 ipsec-isakmp Peer = 82.140.75.254 Extended IP access list 120 access-list 120 permit ip 10.13.1.0 0.0.0.255 10.13.0.0 0.0.0.255 Current peer: 82.140.75.254 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ sharks, } Reverse Route Injection Enabled Interfaces using crypto map nolan: Почему-то не показывает интерфейсов???????? На PIX sh crypto map Crypto Map: "M01" interfaces: { outside } Crypto Map "M01" 21 ipsec-isakmp Peer = 195.190.123.218 access-list ipsec01; 1 elements access-list ipsec01 line 1 permit ip 10.13.0.0 255.255.255.0 10.13.1.0 255.255.255.0 (hitcnt=59746) Current peer: 195.190.123.218 Security association lifetime: 4608000 kilobytes/28800 seconds PFS (Y/N): N Transform sets={ E01, }
	Правка \| Высказать мнение \| Ответить \| Рекомендовать в FAQ \| Cообщить модератору \| Наверх

Оглавление

ipsec PIX C805. Прошу помощи., ВОЛКА, 15:43 , 20-Июн-05, (1)
- ipsec PIX C805. Прошу помощи., svsleaves, 15:49 , 20-Июн-05, (2)
  - ipsec PIX C805. Прошу помощи., ВОЛКА, 15:51 , 20-Июн-05, (3)
    - ipsec PIX C805. Прошу помощи., svsleaves, 19:33 , 20-Июн-05, (4)
      - ipsec PIX C805. Прошу помощи., ВОЛКА, 22:22 , 20-Июн-05, (5)
        
        ipsec PIX C805. Прошу помощи., svsleaves, 12:27 , 21-Июн-05, (6)
        
        ipsec PIX C805. Прошу помощи., svsleaves, 15:39 , 21-Июн-05, (7)

Индекс форумов | Темы | Пред. тема | След. тема

Сообщения по теме

1. "ipsec PIX C805. Прошу помощи."

Сообщение от ВОЛКА on 20-Июн-05, 15:43  (MSK)

ну так вы привяжите этот криптомап к интерфейсу...

Удалить Правка | Высказать мнение | Ответить | Рекомендовать в FAQ | Cообщить модератору | Наверх

2. "ipsec PIX C805. Прошу помощи."

Сообщение от svsleaves (ok) on 20-Июн-05, 15:49  (MSK)

>ну так вы привяжите этот криптомап к интерфейсу...
Я пытался. Может не так?
crypto map nolan local-address Serial 0
Linkor(config)#^Z
Linkor#sh cry map
Crypto Map: "nolan" idb: Serial0 local address: 195.190.123.218
Crypto Map "nolan" 11 ipsec-isakmp
        Peer = 82.140.75.254
        Extended IP access list 120
            access-list 120 permit ip 10.13.1.0 0.0.0.255 10.13.0.0 0.0.0.255
        Current peer: 82.140.75.254
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                sharks,
        }
        Interfaces using crypto map nolan:

Удалить Правка | Высказать мнение | Ответить | Рекомендовать в FAQ | Cообщить модератору | Наверх

3. "ipsec PIX C805. Прошу помощи."

Сообщение от ВОЛКА on 20-Июн-05, 15:51  (MSK)

conf t
int s0
crypto ....

Удалить Правка | Высказать мнение | Ответить | Рекомендовать в FAQ | Cообщить модератору | Наверх

4. "ipsec PIX C805. Прошу помощи."

Сообщение от svsleaves (ok) on 20-Июн-05, 19:33  (MSK)

>conf t
>int s0
> crypto ....
Теперь сдвинулось, но все равно не работает,
хотя я ошибок не вижу :(
pix
debug crypto isakmp
debug crypto ipsec
ISAKMP (0): beginning Main Mode exchange
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 21 policy
ISAKMP:      encryption 3DES-CBC
ISAKMP:      hash MD5
ISAKMP:      default group 2
ISAKMP:      auth pre-share
ISAKMP:      life type in seconds
ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP (0): processing vendor id payload
ISAKMP (0): processing vendor id payload
ISAKMP (0): remote peer supports dead peer detection
ISAKMP (0): processing vendor id payload
ISAKMP (0): speaking to another IOS box!
ISAKMP (0): processing vendor id payload
ISAKMP (0): received xauth v6 vendor id
ISAKMP (0): ID payload
        next-payload : 8
        type         : 1
        protocol     : 17
        port         : 500
        length       : 8
ISAKMP (0): Total payload length: 12
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
ISAKMP (0): beginning Quick Mode exchange, M-ID of -472258391:e3d9e8a9IPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0xf9fcd4e0(4194096352) for SA
        from 195.190.123.218 to   82.140.75.254 for prot 3
return status is IKMP_NO_ERROR
ISAKMP (0): sending INITIAL_CONTACT notify
ISAKMP (0): sending NOTIFY message 24578 protocol 1
VPN Peer: ISAKMP: Added new peer: ip:195.190.123.218/500 Total VPN Peers:1
VPN Peer: ISAKMP: Peer ip:195.190.123.218/500 Ref cnt incremented to:1 Total VPN Peers:1
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 3822708905
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP:   attributes in transform:
ISAKMP:      encaps is 1
ISAKMP:      SA life type in seconds
ISAKMP:      SA life duration (basic) of 28800
ISAKMP:      SA life type in kilobytes
ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
ISAKMP:      authenticator is HMAC-MD5
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) dest= 195.190.123.218, src= 82.140.75.254,
    dest_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    src_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac ,
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
ISAKMP (0): processing NONCE payload. message ID = 3822708905
ISAKMP (0): processing ID payload. message ID = 3822708905
ISAKMP (0): processing ID payload. message ID = 3822708905
ISAKMP (0): processing NOTIFY payload 24576 protocol 3
        spi 676881456, message ID = 3822708905
ISAKMP (0): processing responder lifetime
ISAKMP (0): responder lifetime of 3600smap_alloc_entry: allocating entry 2
map_alloc_entry: allocating entry 1
ISAKMP (0): Creating IPSec SAs
        inbound SA from 195.190.123.218 to   82.140.75.254 (proxy       10.13.1.0 to       10.13.0.0)
        has spi 4194096352 and conn_id 2 and flags 4
        lifetime of 3600 seconds
        lifetime of 4608000 kilobytes
        outbound SA from   82.140.75.254 to 195.190.123.218 (proxy       10.13.0.0 to       10.13.1.0)
        has spi 676881456 and conn_id 1 and flags 4
        lifetime of 3600 seconds
        lifetime of 4608000 kilobytesIPSEC(key_engine): got a queue event...
IPSEC(initialize_sas): ,
  (key eng. msg.) dest= 82.140.75.254, src= 195.190.123.218,
    dest_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    src_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac ,
    lifedur= 3600s and 4608000kb,
    spi= 0xf9fcd4e0(4194096352), conn_id= 2, keysize= 0, flags= 0x4
IPSEC(initialize_sas): ,
  (key eng. msg.) src= 82.140.75.254, dest= 195.190.123.218,
    src_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    dest_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac ,
    lifedur= 3600s and 4608000kb,
    spi= 0x28586430(676881456), conn_id= 1, keysize= 0, flags= 0x4
VPN Peer: IPSEC: Peer ip:195.190.123.218/500 Ref cnt incremented to:2 Total VPN Peers:1
VPN Peer: IPSEC: Peer ip:195.190.123.218/500 Ref cnt incremented to:3 Total VPN Peers:1
return status is IKMP_NO_ERROR
ISADB: reaper checking SA 0xfbcc44, conn_id = 0
=========================
router:
#show crypto engine connections active
  ID Interface            IP-Address      State  Algorithm           Encrypt  Decrypt
  15 Serial0              195.190.123.218 set    HMAC_MD5+3DES_56_C        0        0
2000 Serial0              195.190.123.218 set    HMAC_MD5+3DES_56_C        0       68
2001 Serial0              195.190.123.218 set    HMAC_MD5+3DES_56_C        0        0
#show crypto ipsec sa
interface: Serial0
    Crypto map tag: nolan, local addr. 195.190.123.218
   protected vrf:
   local  ident (addr/mask/prot/port): (10.13.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.13.0.0/255.255.255.0/0/0)
   current_peer: 82.140.75.254:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 69, #pkts decrypt: 69, #pkts verify 69
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 69
     local crypto endpt.: 195.190.123.218, remote crypto endpt.: 82.140.75.254
     path mtu 1500, ip mtu 1500, ip mtu idb Serial0
     current outbound spi: F9FCD4E0
     inbound esp sas:
      spi: 0x28586430(676881456)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 2000, flow_id: 1, crypto map: nolan
        sa timing: remaining key lifetime (k/sec): (4492512/2703)
        IV size: 8 bytes
        replay detection support: Y
inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0xF9FCD4E0(4194096352)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 2001, flow_id: 2, crypto map: nolan
        sa timing: remaining key lifetime (k/sec): (4492520/2681)
        IV size: 8 bytes
        replay detection support: Y
     outbound ah sas:
     outbound pcp sas:
#show crypto isakmp sa
dst             src             state          conn-id slot
195.190.123.218 82.140.75.254   QM_IDLE             15    0

Удалить Правка | Высказать мнение | Ответить | Рекомендовать в FAQ | Cообщить модератору | Наверх

5. "ipsec PIX C805. Прошу помощи."

Сообщение от ВОЛКА on 20-Июн-05, 22:22  (MSK)

debug crypto isa
debug crypto ipsec
с двух сторон покажите...

Удалить Правка | Высказать мнение | Ответить | Рекомендовать в FAQ | Cообщить модератору | Наверх

6. "ipsec PIX C805. Прошу помощи."

Сообщение от svsleaves (??) on 21-Июн-05, 12:27  (MSK)

>debug crypto isa
>debug crypto ipsec
>
>с двух сторон покажите...
Может из-за того что часы на роутере "съехали"
Или нет default router на удаленном комп. из 10.13.1.0/24?
Ведь в одну сторону работает, а обратно ничего не идет :(
PIX
ISAKMP (0): retransmitting phase 1...
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 21 policy
ISAKMP:      encryption 3DES-CBC
ISAKMP:      hash MD5
ISAKMP:      default group 2
ISAKMP:      auth pre-share
ISAKMP:      life type in seconds
ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP (0): processing vendor id payload
ISAKMP (0): processing vendor id payload
ISAKMP (0): remote peer supports dead peer detection
ISAKMP (0): processing vendor id payload
ISAKMP (0): speaking to another IOS box!
ISAKMP (0): processing vendor id payload
ISAKMP (0): received xauth v6 vendor id
ISAKMP (0): ID payload
        next-payload : 8
        type         : 1
        protocol     : 17
        port         : 500
        length       : 8
ISAKMP (0): Total payload length: 12
return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
ISAKMP (0): beginning Quick Mode exchange, M-ID of -1301902146:b2668cbeIPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0x383b51a8(943411624) for SA
        from 195.190.123.218 to   82.140.75.254 for prot 3
return status is IKMP_NO_ERROR
ISAKMP (0): sending INITIAL_CONTACT notify
ISAKMP (0): sending NOTIFY message 24578 protocol 1
VPN Peer: ISAKMP: Added new peer: ip:195.190.123.218/500 Total VPN Peers:1
VPN Peer: ISAKMP: Peer ip:195.190.123.218/500 Ref cnt incremented to:1 Total VPN Peers:1
crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 2993065150
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_3DES
ISAKMP:   attributes in transform:
ISAKMP:      encaps is 1
ISAKMP:      SA life type in seconds
ISAKMP:      SA life duration (basic) of 28800
ISAKMP:      SA life type in kilobytes
ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
ISAKMP:      authenticator is HMAC-MD5
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) dest= 195.190.123.218, src= 82.140.75.254,
    dest_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    src_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac ,
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
ISAKMP (0): processing NONCE payload. message ID = 2993065150
ISAKMP (0): processing ID payload. message ID = 2993065150
ISAKMP (0): processing ID payload. message ID = 2993065150
ISAKMP (0): processing NOTIFY payload 24576 protocol 3
        spi 3538283488, message ID = 2993065150
ISAKMP (0): processing responder lifetime
ISAKMP (0): responder lifetime of 3600smap_alloc_entry: allocating entry 3
map_alloc_entry: allocating entry 4
ISAKMP (0): Creating IPSec SAs
        inbound SA from 195.190.123.218 to   82.140.75.254 (proxy       10.13.1.0 to       10.13.0.0)
        has spi 943411624 and conn_id 3 and flags 4
        lifetime of 3600 seconds
        lifetime of 4608000 kilobytes
        outbound SA from   82.140.75.254 to 195.190.123.218 (proxy       10.13.0.0 to       10.13.1.0)
        has spi 3538283488 and conn_id 4 and flags 4
        lifetime of 3600 seconds
        lifetime of 4608000 kilobytesIPSEC(key_engine): got a queue event...
IPSEC(initialize_sas): ,
  (key eng. msg.) dest= 82.140.75.254, src= 195.190.123.218,
    dest_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    src_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac ,
    lifedur= 3600s and 4608000kb,
    spi= 0x383b51a8(943411624), conn_id= 3, keysize= 0, flags= 0x4
IPSEC(initialize_sas): ,
  (key eng. msg.) src= 82.140.75.254, dest= 195.190.123.218,
    src_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    dest_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac ,
    lifedur= 3600s and 4608000kb,
    spi= 0xd2e5ebe0(3538283488), conn_id= 4, keysize= 0, flags= 0x4
VPN Peer: IPSEC: Peer ip:195.190.123.218/500 Ref cnt incremented to:2 Total VPN Peers:1
VPN Peer: IPSEC: Peer ip:195.190.123.218/500 Ref cnt incremented to:3 Total VPN Peers:1
============================================================
router
============================================================
*Apr  5 01:07:59.983: IPSEC(add_sa): have new SAs -- expire existing in 30 sec.,
  (sa) sa_dest= 82.140.75.254, sa_prot= 50,
    sa_spi= 0x383B51A8(943411624),
    sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2001,
  (identity) local= 195.190.123.218, remote= 82.140.75.254,
    local_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4)
*Apr  5 01:07:59.987: IPSEC(delete_sa): deleting SA,
  (sa) sa_dest= 82.140.75.254, sa_prot= 50,
    sa_spi= 0x383B51A8(943411624),
    sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2001
*Apr  5 01:08:00.727: ISAKMP (0:1): peer does not do paranoid keepalives.
*Apr  5 01:08:00.731: ISAKMP (0:1): deleting SA reason "death by tree-walk node" state (R) QM_IDLE       (peer 82.140.75.254) input queue 0
*Apr  5 01:08:00.803: ISAKMP: set new node -1870319372 to QM_IDLE
*Apr  5 01:08:00.843: CryptoEngine0: generate hmac context for conn id 1
*Apr  5 01:08:00.859: ISAKMP (0:1): sending packet to 82.140.75.254 my_port 500 peer_port 500 (R) QM_IDLE
*Apr  5 01:08:00.867: ISAKMP (0:1): purging node -1870319372
*Apr  5 01:08:00.871: ISAKMP (0:1): Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
*Apr  5 01:08:00.871: ISAKMP (0:1): Old State = IKE_P1_COMPLETE  New State = IKE_DEST_SA
*Apr  5 01:08:00.879: ISAKMP (0:1): deleting SA reason "" state (R) QM_IDLE       (peer 82.140.75.254) input queue 0
*Apr  5 01:08:00.903: ISAKMP (0:1): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr  5 01:08:00.903: ISAKMP (0:1): Old State = IKE_DEST_SA  New State = IKE_DEST_SA
*Apr  5 01:08:01.063: ISAKMP: received ke message (3/1)
Apr  5 01:08:01.063: ISAKMP: ignoring request to send delete notify (no (authenticated) ISAKMP sa) src 195.190.123.218 dst 82.140.75.254 for SPI 0xD2E5EBE0
*Apr  5 01:08:04.367: ISAKMP (0:0): received packet from 82.140.75.254 dport 500 sport 500 Global (N) NEW SA
*Apr  5 01:08:04.375: ISAKMP: local port 500, remote port 500
*Apr  5 01:08:04.379: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 2BB0644
*Apr  5 01:08:04.387: ISAKMP (0:2): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr  5 01:08:04.387: ISAKMP (0:2): Old State = IKE_READY  New State = IKE_R_MM1
*Apr  5 01:08:04.403: ISAKMP (0:2): processing SA payload. message ID = 0
*Apr  5 01:08:04.423: ISAKMP: Looking for a matching key for 82.140.75.254 in default : success
*Apr  5 01:08:04.427: ISAKMP (0:2): found peer pre-shared key matching 82.140.75.254
*Apr  5 01:08:04.431: ISAKMP (0:2) local preshared key found
*Apr  5 01:08:04.443: ISAKMP : Scanning profiles for xauth ...
*Apr  5 01:08:04.447: ISAKMP (0:2): Checking ISAKMP transform 1 against priority 11 policy
*Apr  5 01:08:04.451: ISAKMP:      encryption 3DES-CBC
*Apr  5 01:08:04.451: ISAKMP:      hash MD5
*Apr  5 01:08:04.451: ISAKMP:      default group 2
*Apr  5 01:08:04.451: ISAKMP:      auth pre-share
*Apr  5 01:08:04.455: ISAKMP:      life type in seconds
*Apr  5 01:08:04.455: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
*Apr  5 01:08:04.463: ISAKMP (0:2): atts are acceptable. Next payload is 0
*Apr  5 01:08:04.475: CryptoEngine0: generate alg parameter
*Apr  5 01:08:04.995: CRYPTO_ENGINE: Dh phase 1 status: 0
*Apr  5 01:08:04.995: CRYPTO_ENGINE: Dh phase 1 status: 0
*Apr  5 01:08:04.999: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Apr  5 01:08:04.999: ISAKMP (0:2): Old State = IKE_R_MM1  New State = IKE_R_MM1
*Apr  5 01:08:05.015: ISAKMP (0:2): sending packet to 82.140.75.254 my_port 500 peer_port 500 (R) MM_SA_SETUP
*Apr  5 01:08:05.015: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Apr  5 01:08:05.019: ISAKMP (0:2): Old State = IKE_R_MM1  New State = IKE_R_MM2
*Apr  5 01:08:05.379: ISAKMP (0:2): received packet from 82.140.75.254 dport 500 sport 500 Global (R) MM_SA_SETUP
*Apr  5 01:08:05.383: ISAKMP (0:2): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr  5 01:08:05.383: ISAKMP (0:2): Old State = IKE_R_MM2  New State = IKE_R_MM3
*Apr  5 01:08:05.387: ISAKMP (0:2): processing KE payload. message ID = 0
*Apr  5 01:08:05.387: CryptoEngine0: generate alg parameter
*Apr  5 01:08:06.003: ISAKMP (0:2): processing NONCE payload. message ID = 0
*Apr  5 01:08:06.011: ISAKMP: Looking for a matching key for 82.140.75.254 in default : success
*Apr  5 01:08:06.011: ISAKMP (0:2): found peer pre-shared key matching 82.140.75.254
*Apr  5 01:08:06.015: CryptoEngine0: create ISAKMP SKEYID for conn id 2
*Apr  5 01:08:06.019: ISAKMP (0:2): SKEYID state generated
*Apr  5 01:08:06.023: ISAKMP (0:2): processing vendor id payload
*Apr  5 01:08:06.023: ISAKMP (0:2): vendor ID seems Unity/DPD but major 215 mismatch
*Apr  5 01:08:06.027: ISAKMP (0:2): vendor ID is XAUTH
*Apr  5 01:08:06.031: ISAKMP (0:2): processing vendor id payload
*Apr  5 01:08:06.031: ISAKMP (0:2): vendor ID is DPD
*Apr  5 01:08:06.035: ISAKMP (0:2): processing vendor id payload
*Apr  5 01:08:06.035: ISAKMP (0:2): vendor ID is Unity
*Apr  5 01:08:06.035: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Apr  5 01:08:06.039: ISAKMP (0:2): Old State = IKE_R_MM3  New State = IKE_R_MM3
*Apr  5 01:08:06.051: ISAKMP (0:2): sending packet to 82.140.75.254 my_port 500 peer_port 500 (R) MM_KEY_EXCH
*Apr  5 01:08:06.055: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Apr  5 01:08:06.055: ISAKMP (0:2): Old State = IKE_R_MM3  New State = IKE_R_MM4
*Apr  5 01:08:06.431: ISAKMP (0:2): received packet from 82.140.75.254 dport 500 sport 500 Global (R) MM_KEY_EXCH
*Apr  5 01:08:06.435: ISAKMP (0:2): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr  5 01:08:06.435: ISAKMP (0:2): Old State = IKE_R_MM4  New State = IKE_R_MM5
*Apr  5 01:08:06.439: ISAKMP (0:2): processing ID payload. message ID = 0
*Apr  5 01:08:06.443: ISAKMP (0:2): ID payload
        next-payload : 8
        type         : 1
        address      : 82.140.75.254
        protocol     : 17
        port         : 500
        length       : 12
*Apr  5 01:08:06.443: ISAKMP (0:2): peer matches *none* of the profiles
*Apr  5 01:08:06.447: ISAKMP (0:2): processing HASH payload. message ID = 0
*Apr  5 01:08:06.451: CryptoEngine0: generate hmac context for conn id 2
*Apr  5 01:08:06.459: ISAKMP (0:2): SA authentication status:
        authenticated
*Apr  5 01:08:06.459: ISAKMP (0:2): SA has been authenticated with 82.140.75.254
*Apr  5 01:08:06.459: ISAKMP (0:2): peer matches *none* of the profiles
*Apr  5 01:08:06.463: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Apr  5 01:08:06.463: ISAKMP (0:2): Old State = IKE_R_MM5  New State = IKE_R_MM5
*Apr  5 01:08:06.467: ISAKMP (0:2): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
*Apr  5 01:08:06.467: ISAKMP (0:2): ID payload
        next-payload : 8
        type         : 1
        address      : 195.190.123.218
        protocol     : 17
        port         : 500
        length       : 12
*Apr  5 01:08:06.471: ISAKMP (2): Total payload length: 12
*Apr  5 01:08:06.471: CryptoEngine0: generate hmac context for conn id 2
*Apr  5 01:08:06.479: CryptoEngine0: clear dh number for conn id 1
*Apr  5 01:08:06.483: ISAKMP (0:2): sending packet to 82.140.75.254 my_port 500 peer_port 500 (R) MM_KEY_EXCH
*Apr  5 01:08:06.483: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Apr  5 01:08:06.487: ISAKMP (0:2): Old State = IKE_R_MM5  New State = IKE_P1_COMPLETE
*Apr  5 01:08:06.491: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
*Apr  5 01:08:06.491: ISAKMP (0:2): Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
*Apr  5 01:08:06.631: ISAKMP (0:2): received packet from 82.140.75.254 dport 500 sport 500 Global (R) QM_IDLE
*Apr  5 01:08:06.631: ISAKMP: set new node -1729790444 to QM_IDLE
*Apr  5 01:08:06.635: CryptoEngine0: generate hmac context for conn id 2
*Apr  5 01:08:06.639: ISAKMP (0:2): processing HASH payload. message ID = -1729790444
*Apr  5 01:08:06.639: ISAKMP (0:2): processing NOTIFY INITIAL_CONTACT protocol 1
        spi 0, message ID = -1729790444, sa = 2BB0644
*Apr  5 01:08:06.643: ISAKMP (0:2): SA authentication status:
       authenticated
*Apr  5 01:08:06.643: ISAKMP (0:2): Process initial contact,
bring down existing phase 1 and 2 SA's with local 195.190.123.218 remote 82.140.75.254 remote port 500
*Apr  5 01:08:06.647: IPSEC(key_engine): got a queue event...
*Apr  5 01:08:06.655: ISAKMP (0:2): deleting node -1729790444 error FALSE reason "informational (in) state 1"
*Apr  5 01:08:06.655: ISAKMP (0:2): Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
*Apr  5 01:08:06.655: ISAKMP (0:2): Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
*Apr  5 01:08:06.663: ISAKMP (0:2): received packet from 82.140.75.254 dport 500 sport 500 Global (R) QM_IDLE
*Apr  5 01:08:06.663: ISAKMP: set new node 499481984 to QM_IDLE
*Apr  5 01:08:06.671: CryptoEngine0: generate hmac context for conn id 2
*Apr  5 01:08:06.671: ISAKMP (0:2): processing HASH payload. message ID = 499481984
*Apr  5 01:08:06.675: ISAKMP (0:2): processing SA payload. message ID = 499481984
*Apr  5 01:08:06.675: ISAKMP (0:2): Checking IPSec proposal 1
*Apr  5 01:08:06.675: ISAKMP: transform 1, ESP_3DES
*Apr  5 01:08:06.675: ISAKMP:   attributes in transform:
*Apr  5 01:08:06.675: ISAKMP:      encaps is 1 (Tunnel)
*Apr  5 01:08:06.679: ISAKMP:      SA life type in seconds
*Apr  5 01:08:06.679: ISAKMP:      SA life duration (basic) of 28800
*Apr  5 01:08:06.679: ISAKMP:      SA life type in kilobytes
*Apr  5 01:08:06.679: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
*Apr  5 01:08:06.683: ISAKMP:      authenticator is HMAC-MD5
*Apr  5 01:08:06.683: CryptoEngine0: validate proposal
*Apr  5 01:08:06.687: ISAKMP (0:2): atts are acceptable.
*Apr  5 01:08:06.687: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 195.190.123.218, remote= 82.140.75.254,
    local_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
*Apr  5 01:08:06.695: CryptoEngine0: validate proposal request
*Apr  5 01:08:06.699: IPSEC(kei_proxy): head = nolan, map->ivrf = , kei->ivrf =
*Apr  5 01:08:06.707: ISAKMP (0:2): processing NONCE payload. message ID = 499481984
*Apr  5 01:08:06.707: ISAKMP (0:2): processing ID payload. message ID = 499481984
*Apr  5 01:08:06.711: ISAKMP (0:2): processing ID payload. message ID = 499481984
*Apr  5 01:08:06.711: ISAKMP (0:2): asking for 1 spis from ipsec
*Apr  5 01:08:06.711: ISAKMP (0:2): Node 499481984, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Apr  5 01:08:06.715: ISAKMP (0:2): Old State = IKE_QM_READY  New State = IKE_QM_SPI_STARVE
*Apr  5 01:08:06.715: IPSEC(key_engine): got a queue event...
*Apr  5 01:08:06.723: IPSEC(spi_response): getting spi 4022030768 for SA
        from 195.190.123.218 to 82.140.75.254   for prot 3
*Apr  5 01:08:06.723: ISAKMP: received ke message (2/1)
*Apr  5 01:08:06.967: CryptoEngine0: generate hmac context for conn id 2
*Apr  5 01:08:06.967: CryptoEngine0: ipsec allocate flow
*Apr  5 01:08:06.971: CryptoEngine0: ipsec allocate flow
*Apr  5 01:08:06.983: ISAKMP (0:2): Creating IPSec SAs
*Apr  5 01:08:06.983:         inbound SA from 82.140.75.254 to 195.190.123.218 (f/i)  0/ 0
        (proxy 10.13.0.0 to 10.13.1.0)
*Apr  5 01:08:06.987:         has spi 0xEFBB51B0 and conn_id 2000 and flags 2
*Apr  5 01:08:06.987:         lifetime of 28800 seconds
*Apr  5 01:08:06.987:         lifetime of 4608000 kilobytes
*Apr  5 01:08:06.987:         has client flags 0x0
*Apr  5 01:08:06.991:         outbound SA from 195.190.123.218 to 82.140.75.254   (f/i)  0/ 0 (proxy 10.13.1.0       to 10.13.0.0      )
*Apr  5 01:08:06.991:         has spi 415323685 and conn_id 2001 and flags A
*Apr  5 01:08:06.991:         lifetime of 28800 seconds
*Apr  5 01:08:06.995:         lifetime of 4608000 kilobytes
*Apr  5 01:08:06.995:         has client flags 0x0
*Apr  5 01:08:06.999: ISAKMP (0:2): sending packet to 82.140.75.254 my_port 500 peer_port 500 (R) QM_IDLE
*Apr  5 01:08:07.003: ISAKMP (0:2): Node 499481984, Input = IKE_MESG_FROM_IPSEC, IKE_SPI_REPLY
*Apr  5 01:08:07.003: ISAKMP (0:2): Old State = IKE_QM_SPI_STARVE  New State = IKE_QM_R_QM2
*Apr  5 01:08:07.007: IPSEC(key_engine): got a queue event...
*Apr  5 01:08:07.007: IPSEC(initialize_sas): ,
  (key eng. msg.) INBOUND local= 195.190.123.218, remote= 82.140.75.254,
    local_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac  (Tunnel),
    lifedur= 28800s and 4608000kb,
    spi= 0xEFBB51B0(4022030768), conn_id= 2000, keysize= 0, flags= 0x2
*Apr  5 01:08:07.011: IPSEC(initialize_sas): ,
  (key eng. msg.) OUTBOUND local= 195.190.123.218, remote= 82.140.75.254,
    local_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4),
    remote_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4),
    protocol= ESP, transform= esp-3des esp-md5-hmac  (Tunnel),
    lifedur= 28800s and 4608000kb,
    spi= 0x18C15625(415323685), conn_id= 2001, keysize= 0, flags= 0xA
*Apr  5 01:08:07.019: IPSEC(kei_proxy): head = nolan, map->ivrf = , kei->ivrf =
*Apr  5 01:08:07.027: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and 82.140.75.254
*Apr  5 01:08:07.027: IPSEC(add mtree): src 10.13.1.0, dest 10.13.0.0, dest_port 0
*Apr  5 01:08:07.031: IPSEC(create_sa): sa created,
  (sa) sa_dest= 195.190.123.218, sa_prot= 50,
    sa_spi= 0xEFBB51B0(4022030768),
    sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2000
*Apr  5 01:08:07.031: IPSEC(create_sa): sa created,
  (sa) sa_dest= 82.140.75.254, sa_prot= 50,
    sa_spi= 0x18C15625(415323685),
    sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 2001
*Apr  5 01:08:07.223: ISAKMP (0:2): received packet from 82.140.75.254 dport 500 sport 500 Global (R) QM_IDLE
*Apr  5 01:08:07.227: CryptoEngine0: generate hmac context for conn id 2
*Apr  5 01:08:07.227: ISAKMP (0:2): deleting node 499481984 error FALSE reason "quick mode done (await)"
*Apr  5 01:08:07.231: ISAKMP (0:2): Node 499481984, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Apr  5 01:08:07.231: ISAKMP (0:2): Old State = IKE_QM_R_QM2  New State = IKE_QM_PHASE2_COMPLETE
*Apr  5 01:08:07.235: IPSEC(key_engine): got a queue event...
*Apr  5 01:08:07.235: IPSEC(key_engine_enable_outbound): rec'd enable notify from ISAKMP
*Apr  5 01:08:07.235: IPSEC(key_engine_enable_outbound): enable SA with spi 415323685/50 for 82.140.75.254

Удалить Правка | Высказать мнение | Ответить | Рекомендовать в FAQ | Cообщить модератору | Наверх

7. "ipsec PIX C805. Прошу помощи."

Сообщение от svsleaves (??) on 21-Июн-05, 15:39  (MSK)

Вопрос снят.
Всем огромное спасибо.
Особенно ВОЛКА

Удалить Правка | Высказать мнение | Ответить | Рекомендовать в FAQ | Cообщить модератору | Наверх

Архив | Удалить

Индекс форумов | Темы | Пред. тема | След. тема

Оцените тред (1=ужас, 5=супер)? [ 1 | 2 | 3 | 4 | 5 ]

Пожалуйста, прежде чем написать сообщение, ознакомьтесь с данными рекомендациями.

Партнёры:

Хостинг:

Закладки на сайте
Проследить за страницей

Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру

1. "ipsec PIX C805. Прошу помощи."
Сообщение от ВОЛКА on 20-Июн-05, 15:43 (MSK)
ну так вы привяжите этот криптомап к интерфейсу...
Удалить	Правка \| Высказать мнение \| Ответить \| Рекомендовать в FAQ \| Cообщить модератору \| Наверх


	2. "ipsec PIX C805. Прошу помощи."
	Сообщение от svsleaves (ok) on 20-Июн-05, 15:49 (MSK)
	>ну так вы привяжите этот криптомап к интерфейсу... Я пытался. Может не так? crypto map nolan local-address Serial 0 Linkor(config)#^Z Linkor#sh cry map Crypto Map: "nolan" idb: Serial0 local address: 195.190.123.218 Crypto Map "nolan" 11 ipsec-isakmp Peer = 82.140.75.254 Extended IP access list 120 access-list 120 permit ip 10.13.1.0 0.0.0.255 10.13.0.0 0.0.0.255 Current peer: 82.140.75.254 Security association lifetime: 4608000 kilobytes/3600 seconds PFS (Y/N): N Transform sets={ sharks, } Interfaces using crypto map nolan:
	Удалить	Правка \| Высказать мнение \| Ответить \| Рекомендовать в FAQ \| Cообщить модератору \| Наверх


	3. "ipsec PIX C805. Прошу помощи."
	Сообщение от ВОЛКА on 20-Июн-05, 15:51 (MSK)
	conf t int s0 crypto ....
	Удалить	Правка \| Высказать мнение \| Ответить \| Рекомендовать в FAQ \| Cообщить модератору \| Наверх


	4. "ipsec PIX C805. Прошу помощи."
	Сообщение от svsleaves (ok) on 20-Июн-05, 19:33 (MSK)
	>conf t >int s0 > crypto .... Теперь сдвинулось, но все равно не работает, хотя я ошибок не вижу :( pix debug crypto isakmp debug crypto ipsec ISAKMP (0): beginning Main Mode exchange crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500 OAK_MM exchange ISAKMP (0): processing SA payload. message ID = 0 ISAKMP (0): Checking ISAKMP transform 1 against priority 21 policy ISAKMP: encryption 3DES-CBC ISAKMP: hash MD5 ISAKMP: default group 2 ISAKMP: auth pre-share ISAKMP: life type in seconds ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 ISAKMP (0): atts are acceptable. Next payload is 0 ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR return status is IKMP_NO_ERROR crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500 OAK_MM exchange ISAKMP (0): processing KE payload. message ID = 0 ISAKMP (0): processing NONCE payload. message ID = 0 ISAKMP (0): processing vendor id payload ISAKMP (0): processing vendor id payload ISAKMP (0): remote peer supports dead peer detection ISAKMP (0): processing vendor id payload ISAKMP (0): speaking to another IOS box! ISAKMP (0): processing vendor id payload ISAKMP (0): received xauth v6 vendor id ISAKMP (0): ID payload next-payload : 8 type : 1 protocol : 17 port : 500 length : 8 ISAKMP (0): Total payload length: 12 return status is IKMP_NO_ERROR crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500 OAK_MM exchange ISAKMP (0): processing ID payload. message ID = 0 ISAKMP (0): processing HASH payload. message ID = 0 ISAKMP (0): SA has been authenticated ISAKMP (0): beginning Quick Mode exchange, M-ID of -472258391:e3d9e8a9IPSEC(key_engine): got a queue event... IPSEC(spi_response): getting spi 0xf9fcd4e0(4194096352) for SA from 195.190.123.218 to 82.140.75.254 for prot 3 return status is IKMP_NO_ERROR ISAKMP (0): sending INITIAL_CONTACT notify ISAKMP (0): sending NOTIFY message 24578 protocol 1 VPN Peer: ISAKMP: Added new peer: ip:195.190.123.218/500 Total VPN Peers:1 VPN Peer: ISAKMP: Peer ip:195.190.123.218/500 Ref cnt incremented to:1 Total VPN Peers:1 crypto_isakmp_process_block:src:195.190.123.218, dest:82.140.75.254 spt:500 dpt:500 OAK_QM exchange oakley_process_quick_mode: OAK_QM_IDLE ISAKMP (0): processing SA payload. message ID = 3822708905 ISAKMP : Checking IPSec proposal 1 ISAKMP: transform 1, ESP_3DES ISAKMP: attributes in transform: ISAKMP: encaps is 1 ISAKMP: SA life type in seconds ISAKMP: SA life duration (basic) of 28800 ISAKMP: SA life type in kilobytes ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 ISAKMP: authenticator is HMAC-MD5 ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) dest= 195.190.123.218, src= 82.140.75.254, dest_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4), src_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4 ISAKMP (0): processing NONCE payload. message ID = 3822708905 ISAKMP (0): processing ID payload. message ID = 3822708905 ISAKMP (0): processing ID payload. message ID = 3822708905 ISAKMP (0): processing NOTIFY payload 24576 protocol 3 spi 676881456, message ID = 3822708905 ISAKMP (0): processing responder lifetime ISAKMP (0): responder lifetime of 3600smap_alloc_entry: allocating entry 2 map_alloc_entry: allocating entry 1 ISAKMP (0): Creating IPSec SAs inbound SA from 195.190.123.218 to 82.140.75.254 (proxy 10.13.1.0 to 10.13.0.0) has spi 4194096352 and conn_id 2 and flags 4 lifetime of 3600 seconds lifetime of 4608000 kilobytes outbound SA from 82.140.75.254 to 195.190.123.218 (proxy 10.13.0.0 to 10.13.1.0) has spi 676881456 and conn_id 1 and flags 4 lifetime of 3600 seconds lifetime of 4608000 kilobytesIPSEC(key_engine): got a queue event... IPSEC(initialize_sas): , (key eng. msg.) dest= 82.140.75.254, src= 195.190.123.218, dest_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4), src_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 3600s and 4608000kb, spi= 0xf9fcd4e0(4194096352), conn_id= 2, keysize= 0, flags= 0x4 IPSEC(initialize_sas): , (key eng. msg.) src= 82.140.75.254, dest= 195.190.123.218, src_proxy= 10.13.0.0/255.255.255.0/0/0 (type=4), dest_proxy= 10.13.1.0/255.255.255.0/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 3600s and 4608000kb, spi= 0x28586430(676881456), conn_id= 1, keysize= 0, flags= 0x4 VPN Peer: IPSEC: Peer ip:195.190.123.218/500 Ref cnt incremented to:2 Total VPN Peers:1 VPN Peer: IPSEC: Peer ip:195.190.123.218/500 Ref cnt incremented to:3 Total VPN Peers:1 return status is IKMP_NO_ERROR ISADB: reaper checking SA 0xfbcc44, conn_id = 0 ========================= router: #show crypto engine connections active ID Interface IP-Address State Algorithm Encrypt Decrypt 15 Serial0 195.190.123.218 set HMAC_MD5+3DES_56_C 0 0 2000 Serial0 195.190.123.218 set HMAC_MD5+3DES_56_C 0 68 2001 Serial0 195.190.123.218 set HMAC_MD5+3DES_56_C 0 0 #show crypto ipsec sa interface: Serial0 Crypto map tag: nolan, local addr. 195.190.123.218 protected vrf: local ident (addr/mask/prot/port): (10.13.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.13.0.0/255.255.255.0/0/0) current_peer: 82.140.75.254:500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0 #pkts decaps: 69, #pkts decrypt: 69, #pkts verify 69 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 69 local crypto endpt.: 195.190.123.218, remote crypto endpt.: 82.140.75.254 path mtu 1500, ip mtu 1500, ip mtu idb Serial0 current outbound spi: F9FCD4E0 inbound esp sas: spi: 0x28586430(676881456) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2000, flow_id: 1, crypto map: nolan sa timing: remaining key lifetime (k/sec): (4492512/2703) IV size: 8 bytes replay detection support: Y inbound ah sas: inbound pcp sas: outbound esp sas: spi: 0xF9FCD4E0(4194096352) transform: esp-3des esp-md5-hmac , in use settings ={Tunnel, } slot: 0, conn id: 2001, flow_id: 2, crypto map: nolan sa timing: remaining key lifetime (k/sec): (4492520/2681) IV size: 8 bytes replay detection support: Y outbound ah sas: outbound pcp sas: #show crypto isakmp sa dst src state conn-id slot 195.190.123.218 82.140.75.254 QM_IDLE 15 0
	Удалить	Правка \| Высказать мнение \| Ответить \| Рекомендовать в FAQ \| Cообщить модератору \| Наверх


	5. "ipsec PIX C805. Прошу помощи."
	Сообщение от ВОЛКА on 20-Июн-05, 22:22 (MSK)
	debug crypto isa debug crypto ipsec с двух сторон покажите...
	Удалить	Правка \| Высказать мнение \| Ответить \| Рекомендовать в FAQ \| Cообщить модератору \| Наверх


	7. "ipsec PIX C805. Прошу помощи."
	Сообщение от svsleaves (??) on 21-Июн-05, 15:39 (MSK)
	Вопрос снят. Всем огромное спасибо. Особенно ВОЛКА
	Удалить	Правка \| Высказать мнение \| Ответить \| Рекомендовать в FAQ \| Cообщить модератору \| Наверх

Архив \| Удалить	Индекс форумов \| Темы \| Пред. тема \| След. тема
Оцените тред (1=ужас, 5=супер)? [ 1 \| 2 \| 3 \| 4 \| 5 ]